Aug 17, 2026
The Tacit Layer Doctrine
Most mistakes shout. Code crashes, a spreadsheet fills with #REF!, someone
tells you that can’t be right. Those are cheap — you find them in seconds.
A smaller class doesn’t shout, and it’s the expensive one. A form accepts a
blank field and saves it as a zero. A report runs clean on a file that stopped
updating in March. A parser hits a malformed number and returns 0 instead of
raising. An inferred value gets written into a column and loses its tag on the
way in, and every reader after that treats it as fact. In each case there was no
channel through which the thing could signal being wrong, and the absence of a
signal got read as a positive one. Nothing looked wrong because nothing could
look wrong — which is why failures of this class survive for months while an
ordinary exception surfaces in seconds.
They also aren’t confined to software. A person who can’t tell you what they don’t know produces the same silence, and it gets read the same way.
An explicit system cannot tell you what it doesn’t know — and treating its quiet as assurance is the same error whether the system is a parser or a person.
I’ve kept a working file about this for about a year, corrected enough times that the corrections are the interesting part. Version seven, and it’s free to download under CC BY 4.0.
What’s in it
Thirty-two pages, three movements:
- Part I — eleven principles of verification discipline. What to check, when, and why the obvious checks don’t work.
- Human Jurisdiction — the bridge. Where that discipline stops, stated with the same specificity as the principles themselves.
- Part II — the tacit layer. One claim about knowledge that doesn’t survive being written down, seen three ways.
Plus a revision history, a set of stated falsifiers, and a licence that lets you take any of it.
Part I: the checking half
The principles group into three clusters rather than eleven separate rules:
- 1–4 · Silence is not evidence. The genus. Once you name the class, it becomes predictive rather than retrospective — you can spot a system that belongs to it before you’ve found the bug.
- 5–6 · Ambiguity and separated stances. Pin down what a term means before executing rather than after; and don’t let the thing that produced the work also grade it. Both get explicit triggers, because a rule without a trigger is an exhortation.
- 7–8 · Context and memory. What’s in the window is all a model knows, and a persistent memory file inherits every knowledge-base problem the moment it becomes load-bearing.
Two lines from this half do most of the work elsewhere in the document:
- Two agreeing sources that descend from a common ancestor are one source.
- A falsifier with no measurement path is decoration.
The bridge: where the method stops
This is the newest section and the one I’d point a reader at first.
A verification discipline that doesn’t state its own jurisdiction invites the assumption that anything it fails to flag is therefore sound — which is the document’s own failure mode, aimed at itself. So the section names four categories that fall outside the method’s reach, and frames them not as weaknesses but as four failures of a single precondition: there must be an artifact, and the claim must be one the artifact can settle.
- Selection — no artifact yet, and one is coming.
- Interpretation — an artifact exists but can’t settle the claim you care about.
- Synthesis — two artifacts settle their own claims and conflict anyway.
- Origination — no artifact, and there won’t be one.
The section carries a placement procedure — four questions that put a live piece of work in a category — and the fourth possible answer is delegable, which is the one people are most reluctant to reach. It also carries a guard, because four named categories of unverifiable work make an excellent alibi. The distinction that defuses it is narrow: these categories are unverifiable in advance, and not unaccountable in retrospect.
The consequence I find most useful, and can’t yet measure: as verification gets cheaper, the share of remaining human effort that is interpretive goes up, not down. Freed bandwidth doesn’t disappear. It relocates into exactly the work that resists mechanization.
Part II: the half that isn’t about machines
Three principles, one claim seen three ways — that the value in most knowledge systems hides in the layer that doesn’t survive being written down, that transferring it can’t be self-served, and that automation shouldn’t own the judgment about what matters, because what matters moves.
These are inherited rather than derived. They come from Polanyi, Nonaka, and the practitioners who built on them, and the document says so plainly — including that it should not be cited as independent support for that literature, since it descends from it, and two sources with a common ancestor are one source.
They’re in the same file as the checking half because the silence of an explicit system is only expensive because of what it’s failing to carry.
Two things to know before you download it
The evidence is biased toward success by construction. Every principle was written after a specific failure, and the document is assembled from the failures that got caught. A careful process that caught eighteen things and a careless one that generated eighteen things needing catching produce the same record. I keep a ledger to hold the denominator, and it isn’t long enough yet to say anything.
Nothing in this corpus corroborates anything else in it. The doctrine, its neutral edition, and the related book chapter are three registers of one argument. Publication order fixes descent but not evidence — it changes what a reader can trace, not how many witnesses there are.
If a principle in it reads as obvious, that’s the intended end state. None of them were obvious in advance of the failure that produced them, and all of them were violated by people who would have endorsed them in the abstract.